BlisterMalware
- colorfake
Elastic observed this loader coming with valid code signatures, being used to deploy secondary payloads in-memory.From MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1027.009Embedded Payloads
“…tion options, obfuscation, and anti-analysis tricks) as well as provide a configuration extractor that can be used to dump BLISTER embedded payloads.”
- T1055Process Injection
“Own Process Injection”
- T1055.012Process Hollowing
“Process Hollowing”
- T1218.002Control Panel
“| PowerCPL.DLL | Power Options Control Panel |”
- T1553.002Code Signing
“Combined with code-signing defense evasion, BLISTER appears designed with security technologies in mind.”
What the reports say
1 report, newest first · the exact sentence from each-
BLISTER Loader“Blister’s GetModuleHandle”
Indicators in its reports
named in the reports above- afb77617a4ca6376…a731d80832c2in 1 report
Copy this indicator · defanged
Thanks — we review every report.